メニュー
Review AI agent systems for approval step circumvention, human-in-the-loop bypass patterns, deferred confirmation exploitation, and social engineering techniques that cause human reviewers to approve malicious agent actions.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Review agentic AI systems for long-term memory store poisoning, vector DB manipulation, cross-session instruction injection, and stale memory exploitation that persists attacker influence across agent sessions.
Review AI agent systems for agent impersonation, capability escalation, missing agent identity primitives, and authorization failures that allow agents to act beyond their granted permissions or impersonate other agents or human users.
Review organizational defenses against AI-assisted spearphishing, voice cloning, synthetic identity fraud, deepfake executive impersonation, and AI-accelerated reconnaissance that dramatically lowers the barrier to highly targeted social engineering attacks.
Review AI-generated content pipelines for deepfake detection gaps, provenance chain failures, C2PA implementation correctness, synthetic media attribution, and trust signal spoofing that undermines content authenticity verification.
Review AI browser agents for DOM injection attacks, credential harvesting via web automation, malicious web content that hijacks agent actions, session cookie theft, and phishing sites engineered to exploit browser-controlling AI agents.
Review upstream dataset integrity controls, HuggingFace repository risks, dataset versioning, dependency pinning, and third-party dataset provenance to prevent malicious data from entering training or RAG pipelines.
| name | human-in-the-loop-bypass |
| description | Review AI agent systems for approval step circumvention, human-in-the-loop bypass patterns, deferred confirmation exploitation, and social engineering techniques that cause human reviewers to approve malicious agent actions. |
| last_reviewed | "2026-04-30T00:00:00.000Z" |
A human approval step that can be bypassed, confused, or deferred is not a control — it is theater.
Human-in-the-loop (HITL) controls are placed at the highest-risk points in AI pipelines — irreversible actions, high-value transactions, sensitive data access. They exist precisely because automated checks are insufficient. An attacker who can bypass, confuse, or socially engineer the approval step removes the last line of defense. HITL bypass is not just an AI security problem; it combines agentic attack techniques with classical social engineering.
| Principle | What It Means Here |
|---|---|
| Validate | The approval UI presents the exact parameters of the action to be executed — not a model-generated summary. What the human sees is what the system will execute. |
| Scope | Approvals are scoped to a single, specific, immutable action. They cannot be extended to cover follow-up actions or action chains not present at approval time. |
| Isolate | Timeout-based auto-approval does not exist. A non-response results in cancellation, not execution. |
| Enforce | All approved actions are logged with the reviewer identity, the exact parameters shown at approval time, and the parameters actually executed. Discrepancies are treated as incidents. |
The core vulnerability: Human reviewers approve a description. If the description is generated by the agent — which may be operating on attacker-influenced content — the description can be crafted to appear benign while the underlying parameters are malicious.
import hashlib, json
from dataclasses import dataclass
@dataclass
class ApprovalRequest:
action_type: str
parameters: dict # exact, structured parameters — not prose
parameter_hash: str # SHA-256 of canonical JSON of parameters
requested_by: str
requested_at: str
def create_approval_request(action_type: str, parameters: dict) -> ApprovalRequest:
canonical = json.dumps(parameters, sort_keys=True)
param_hash = hashlib.sha256(canonical.encode()).hexdigest()
return ApprovalRequest(
action_type=action_type,
parameters=parameters,
parameter_hash=param_hash,
requested_by=current_agent_id(),
requested_at=utcnow_iso(),
)
def execute_after_approval(approval_id: str, approval_decision: ApprovalDecision):
request = load_approval_request(approval_id)
if not approval_decision.approved:
return # explicit rejection
# Verify parameters have not changed since approval was shown
canonical = json.dumps(request.parameters, sort_keys=True)
if hashlib.sha256(canonical.encode()).hexdigest() != request.parameter_hash:
log_security_incident("approval_parameter_tampered", approval_id)
raise IntegrityError("Action parameters changed after approval was shown")
execute_action(request.action_type, request.parameters)
To: external@example.com | Subject: ... | Body: (first 200 chars) — not "send a summary email to the team."archive tool takes a destination parameter that the agent set to attacker-ftp://.... The reviewer approves based on the description.The core vulnerability: Approval scope creep and reviewer fatigue both undermine HITL. Broad approvals allow action chains; fatigue causes reviewers to approve without scrutiny.
def check_approval_timeout(approval_id: str) -> None:
request = load_approval_request(approval_id)
if utcnow() - request.requested_at > timedelta(hours=4):
cancel_approval_request(
approval_id,
reason="timeout_no_response",
notify_reviewer=True,
)
# Never auto-approve on timeout
Eliminate timeout-based auto-approval. Find every approval request handler and verify non-response results in cancellation. This single change removes the most common HITL bypass pattern — the attacker who just waits.